Retaining Fields from Current Event or Group During Stream Aggregation

1. A method, comprising: receiving, at a data processing system, a stream of events having an input shape comprising a plurality of attributes, wherein the data processing system includes a pipeline comprising a query stage that includes a summary subsection and a group by subsection, and wherein the summary subsection includes a parameter flag; executing, by the query stage of the data processing system, a query on the stream of events, and the executing comprises: summarizing, by the summary subsection, data of a first attribute of the plurality of attributes based on an aggregate function to generate values of data for a result-set, collecting, by the group by subsection, data of events with values that are identical for a second attribute of the plurality of attributes based on a group by function to group the result-set by the second attribute, and in response to the parameter flag being enabled, introducing, by the summary subsection, a current function into the query using continuous query language as current(X), where X is a third attribute of the plurality of attributes to be preserved, and preserving data of the third attribute based on the current function, wherein values of the data for the third attribute are latest values of the data for the third attribute from the stream of events and the third attribute is not operated on by the group by function; and outputting, by the data processing system, events having an output shape comprising the first attribute, the second attribute, and the third attribute, wherein the events include the values of the data for the result set, the values of the data for the second attribute, and the values of the data for the third attribute.

2. The method of claim 1 , wherein the current function preserves the third attribute from the input shape to the output shape.

3. A system comprising: a data processing system that includes one or more processors and non-transitory machine readable storage medium having instructions stored thereon that when executed by the one or more processors cause the one or more processors to perform a process comprising: receiving, at the data processing system, a stream of events having an input shape comprising a plurality of attributes, wherein the data processing system includes a pipeline comprising a query stage that includes a summary subsection and a group by subsection, and wherein the summary subsection includes a parameter flag; executing, by the query stage of the data processing system, a query on the stream of events, and the executing comprises: summarizing, by the summary subsection, data of a first attribute of the plurality of attributes based on an aggregate function to generate values of data for a result-set, collecting, by the group by subsection, data of events with values that are identical for a second attribute of the plurality of attributes based on a group by function to group the result-set by the second attribute, and in response to the parameter flag being enabled, introducing, by the summary subsection, a current function into the query using continuous query language as current(X), where X is a third attribute of the plurality of attributes to be preserved, and preserving data of the third attribute based on the current function, wherein values of the data for the third attribute are latest values of the data for the third attribute from the stream of events and the third attribute is not operated on by the group by function; and outputting, by the data processing system, events having an output shape comprising the first attribute, the second attribute, and the third attribute, wherein the events include the values of the data for the result set, the values of the data for the second attribute, and the values of the data for the third attribute.

4. The system of claim 3 , wherein the current function preserves the third attribute from the input shape to the output shape.

5. A non-transitory machine readable storage medium having instructions stored thereon that when executed by one or more processors cause the one or more processors to perform a method comprising: receiving, at a data processing system, a stream of events having an input shape comprising a plurality of attributes, wherein the data processing system includes a pipeline comprising a query stage that includes a summary subsection and a group by subsection, and wherein the summary subsection includes a parameter flag; executing, by the query stage of the data processing system, a query on the stream of events, and the executing comprises: summarizing, by the summary subsection, data of a first attribute of the plurality of attributes based on an aggregate function to generate values of data for a result-set, collecting, by the group by subsection, data of events with values that are identical for a second attribute of the plurality of attributes based on a group by function to group the result-set by the second attribute, and in response to the parameter flag being enabled, introducing, by the summary subsection, a current function into the query using continuous query language as current(X), where X is a third attribute of the plurality of attributes to be preserved, and preserving data of the third attribute based on the current function, wherein values of the data for the third attribute are latest values of the data for the third attribute from the stream of events and the third attribute is not operated on by the group by function; and outputting, by the data processing system, events having an output shape comprising the first attribute, the second attribute, and the third attribute, wherein the events include the values of the data for the result set, the values of the data for the second attribute, and the values of the data for the third attribute.

6. The non-transitory machine readable storage medium of claim 5 , wherein the current function preserves the third attribute from the input shape to the output shape.